Compliance - Digital tools and personal support

As a continuation of the security requirements established in the NIS Directive, the follow-up NIS2 is now being introduced. In the new directive, the requirements are stricter, but most notably, supervisory authorities will be able to impose concrete sanctions on organizations that fail to comply. The directive will be implemented into national legislation during the fall. The main purpose is to raise the level of security within critical sectors of society. However, companies and organizations with an indirect connection to these sectors may also fall under the scope of affected activities. Lantero has developed some questions to help you determine if you need to comply with the regulations. If the answer to any of these questions is yes, you should take a closer look at the regulations and establish a plan or approach to the new rules. * Do we provide services or infrastructure in sectors such as energy, transport, banking, healthcare, water supply, or digital services? * Do we have customers in essential societal operations? (Even suppliers and third-party vendors may fall under NIS2.) * Do we manage critical infrastructure or digital services that impact national security or economic stability? (Organizations that affect national or societal security are generally included.) * Does our organization have more than 50 employees or an annual turnover exceeding 10 million euros? * Are we dependent on networks and information systems to provide our products or services? (NIS2 targets organizations whose operations rely on digital systems.) * Have we previously been subjected to cyberattacks or other security incidents that may have affected our operations or our customers' data integrity? (Companies that handle sensitive data and have been targeted by cyber threats may fall under NIS2.) Given that the directive also affects many subcontractors to the primarily affected organizations, it becomes a concern for many. It is still unclear how thoroughly the follow-up of subcontractors' NIS2 compliance will be conducted, but it is likely that it will be an advantage to demonstrate a structured approach and awareness of where one stands in relation to the framework. "We encounter many who feel that the regulations are too far-reaching and impose requirements on more organizations than necessary. At the same time, there is an opposing view among those who work closely with security issues or have been exposed to various types of attacks. They often feel that the framework is wise for most to adhere to," says Petter Tiger at Lantero.

Lantero has conducted a review of how the municipal sector is working with whistleblowing/whistleblower systems and the types of solutions being used. Generally, there is awareness of the issue, and many municipalities are working methodically and seriously, while a surprisingly large portion still have questionable internal setups for whistleblowing. The largest provider in the sector is Lantero, serving nearly a quarter of Sweden's municipalities. Additionally, many municipalities are working with other reputable providers who offer a satisfactory level of expertise and case management support. Close to five percent of municipalities have established setups through a coordinated routine with other municipalities, which often results in a pragmatic and reasonable handling of confidentiality issues, but may raise more significant concerns about ensuring anonymity and may miss the opportunity for specialized support competence as part of the case management process. "What surprises us in our review of the whistleblowing issue within municipalities is how many still lack support from an independent party," says Andreas Wahlström, Partner Manager at Lantero, who conducted the review. "When serious cases arise, the value of that help usually becomes clear." Around one-fifth of all Swedish municipalities have set up various types of internal solutions. As the legislation in this area is structured, there is room for interpretation regarding what it means, for example, to guarantee independence, ensure anonymity/confidentiality, or report orally, but according to Andreas Wahlström, it is largely a matter of creating security and trust among employees. "If the IT department theoretically has access to information regarding a report, it creates credibility issues, even if there are strict rules for how IT department personnel may access and view the information. It’s worth asking what an organization should do to be able to say it guarantees confidentiality for the whistleblower." As anti-corruption efforts are strengthened within municipalities and whistleblower systems become a more natural part of the work against misconduct, it is likely that the remaining homemade solutions will soon be replaced.

Since it became mandatory for employers to have an internal whistleblower channel, the employers using Lantero’s whistleblower channel have received over 2,500 reports in total. Municipal operations have three times as many reports compared to private operations. The introduction of the whistleblower law has not been without challenges, but we can see that many employers have greatly benefited from their whistleblower processes. ### Thank you to all brave and wise individuals June 23 is The World Whistleblower Day. With all the thousands of cases that have come in, we at Lantero want to take the opportunity to acknowledge and thank all the brave individuals who have taken the time and energy to report suspected misconduct. We also want to thank all the wise employers who take whistleblowing seriously and understand the benefits of a well-functioning whistleblower process. ### Significant differences Lantero has customers from both public and private sectors. We can note that public operations (largely municipalities) receive three times more reports compared to private operations. The reasons for this can be several: - Municipalities operate in many different areas - Municipalities are typically relatively large employers - Municipalities are major purchasers of both goods and services - Several municipalities are exposed to organized crime But we also believe it may be due to many municipalities being very ambitious with their whistleblower channel. They have worked actively to make the channel known and encouraged its use when needed. Therefore, receiving many reports does not necessarily have to be a negative thing. It can be a sign that the employer is open to improving the operation. ### The new whistleblower law is not without challenges Compared to the previous whistleblower law, the new one is more comprehensive. This does not necessarily mean it is clearer. For example, the assessment of whether an incoming report falls under the whistleblower law or not should be based on several factors that are open to interpretation. What does it mean that a case has “public interest” to be investigated? If it cannot be conclusively determined that the whistleblower received the information in a “work-related context,” should it not be classified as a whistleblower case? If a case has public interest, but the whistleblower is not covered by the whistleblower law’s protection, what is the employer’s responsibility then? We believe that the key to answering these questions lies in the original purpose of the whistleblower law: To protect informants to encourage people to dare to report suspected irregularities. The law has not yet been extensively tested. This means there are still ambiguities. Another challenge is the requirement for independence in the handling of incoming cases. A requirement that we think is entirely reasonable and central to whistleblower legislation. However, we often see that employers struggle to meet this requirement. Particularly for smaller employers, it is difficult to solve this with internal resources. It is therefore crucial to have well-formulated, anchored, and communicated routines from the start on how this should be handled. If a conflict of interest arises in the handling of a case, it should be simple, obvious, and well-anchored to bring in an external resource. On an overall level, we can unfortunately state that our experience is that internal whistleblower channels have an important function to fulfill. A function that, in the short time since the new law became mandatory, has proven useful and valuable for many employers. Good luck to all brave individuals and wise employers! The World Whistleblower Day is for you.